Clop, the Russian state-linked ransomware group, has now claimed to have hacked 59 companies after exploiting a known bug in a number of file transfer applications developed by software house Cleo.
The flaw, CVE-2024-50623, affects Cleo’s LexiCom, VLTransfer and Harmony software, inadvertently enables remote code execution, and was first disclosed on October 30, 2024. Clop later published the list of victims on its dark web site, though many are denying that a breach has taken place.
Clop is claiming to have issued intrusion notices to its victims, including Cleo itself, on its own website, but also that impacted companies are refusing to submit to ransom demands.
Cleo RCE bug impactPrzemyslaw Jedrysik, a spokesperson for German manufacturer Covestro, was one of the few willing to reveal the extent of the intrusion to TechCrunch.
He disclosed unauthorized access by Clop to a US logistics server, but that it has since “taken measures to ensure system integrity, enhance security monitoring and proactively notify customers”. He also claimed that information on this server wasn’t of a sensitive nature.
Spokespeople for several companies including car rental firm Hertz and Australian logistics company Linfox have, however, explicitly denied intrusions in statements to TechCrunch.
Clop also listed as a victim software supply chain enterprise Blue Yonder as a victim, though, at press time, it hasn’t issued any cybersecurity incident updates since December 12, 2024. However, a spokesperson did say in a statement to TechCrunch that Blue Yonder does use Cleo software, and that it was investigating potential unauthorized access to its servers.
The group is claiming it’ll disclose more of its victims in this attack on January 21, 2025, though the true scale of the attack remains unclear.
You might also likeA new rumor suggests that Xiaomi is working on a new phone with an enormous 7,500mAh battery, tipped for release via the company’s Redmi brand.
Noted tipster Digital Chat Station shared a Weibo post which says Xiaomi has begun testing on the 7,500mAh “super-large” battery for a “sub-series”, which, as Android Authority reports, refers to Redmi, a Xiaomi subsidiary.
It’s likely that a battery with this much capacity would make use of a silicon-carbon design, which offers a much greater energy density than the previously standard lithium-based batteries still found in the iPhone 16, Samsung Galaxy S24, and Google Pixel 9.
For reference, the Google Pixel 9 sports a 4,700mAh battery, the Samsung Galaxy S24 sports a 4,000mAh battery, and the iPhone 16 comes in at 3,561mAh – less than half the capacity of the rumored Redmi phone.
As with most aspects of smartphone hardware, numbers don’t tell the full story – battery life is determined by a wide range of factors in addition to capacity, such as chipset efficiency, display resolution and brightness, and heat dissipation. For example, Apple is able to achieve satisfactory battery life with the iPhone thanks to the company’s famously great optimization.
Still, we would generally expect a phone with a 7,500mAh battery to substantially outlast one with a 3,500mAh battery in an equal test, simply because the hardware gap is so wide.
Across the latter half of 2024, we saw Chinese phone manufacturers fit silicon-carbon batteries to new flagship phones like the Oppo Find X8 Pro and the OnePlus 13, but Xiaomi doesn’t tend to issue flagship-level devices through its Redmi brand.
Typically, Redmi devices occupy the budget to mid-tier space in Xiaomi’s portfolio, which does allow for a handful of higher-end features with each new device. The recently released Redmi Note 14 Pro Plus, for example, comes equipped with a 6,200mAh battery and support for 90W wired charging.
Analysis: Return of the stamina monsters? Phones like the Asus ROG Phone 9 Pro (above) have offered large battery capacities like 5,800mAh recently, but Xiaomi's phone would comfortably eclipse that. (Image credit: Future)While we have seen specialized, battery-focused phones released in the past (see Energizer's 28,000mAh battery phone), as well as ruggedized handsets with very large batteries designed for extended periods away from the charger, a 7,500mAh battery would without a doubt be the largest we’ve ever seen in a conventional smartphone.
Personally, I think developments in battery technology are some of the most exciting in modern smartphone hardware: larger, more efficient batteries are a truly consumer-friendly addition, and could have a positive impact on the environment too if there’s a reduced need for charging.
Furthermore, we’re all no stranger to being out with friends or family and hearing the familiar request for a portable charger or to find somewhere with a wall socket to top up – bigger, better batteries should be able to allay that anxiety.
This is all contingent on the big three phone makers – Apple, Samsung, and Google – taking note of the progress being made by global manufacturers. The best Xiaomi phones are impressive, truly premium units that push the envelope, but with a limited presence in Europe and none whatsoever in the US, it doesn’t have too much of a chance of making waves.
Luckily, we’ve already heard suggestions that Samsung could be picking silicon-carbon batteries for the Galaxy S26 lineup, which we’d expect to launch next year. I’m hoping our list of the best Samsung Galaxy phones will soon be full of handsets that push the envelope when it comes to battery life.
You might also likeW3 Total Cache, a popular website performance optimization WordPress plugin, reportedly carried a high-severity vulnerability which allowed attackers to access sensitive information, abuse service plan limits, and run unauthorized actions.
The vulnerability is tracked as CVE-2024-12365, and has a severity score of 8.5/10 (high). It occurs due to a missing capability check in a function, and affects all versions up to, and including, 2.8.1.
“This makes it possible for authenticated attackers, with Subscriber-level access and above, to obtain the plugin's nonce value and perform unauthorized actions, resulting in information disclosure, service plan limits consumption as well as making web requests to arbitrary locations originating from the web application that can be used to query information from internal services, including instance metadata on cloud-based applications,” it was said on the National Vulnerability Database website.
WordPress and its pluginsThe WordPress plugin repository states that W3 Total Cache has more than a million downloads, with less than half (42.8% running the latest version), meaning more than 500,000 websites could still be vulnerable.
The plugin’s vendor, BoldGrid, has released a fix with its version 2.8.2, and WordPress security project Wordfence urged all users to apply the fix immediately.
WordPress is the world’s most popular website builder platform, powering roughly half of all the websites on the internet.
As such, it is a popular target for cybercriminals, as well, but since the platform is relatively secure, threat actors are mostly focused on third-party plugins and themes, especially those with poor developer or community support.
W3 Total Cache is a powerful WordPress plugin designed to improve website performance by caching content, minimizing code, and optimizing server resources. It claims to be able to help reduce load times, enhance user experience, and improve SEO by integrating features like content delivery network (CDN) support and database caching.
Via BleepingComputer
You might also likeWe know the Powerbeats Pro 2 exist (after a slew of leaks sprouted up in September last year), and we all-but-know they're launching in 2025. And it now looks like the launch is imminent, which means we could be just weeks away from getting them in our ears.
As 91Mobiles reports, Apple has been filing the regulatory paperwork for its new buds with a bunch of official bodies. That's something Apple tends to do just before its new products go on sale.
You can usually glean some interesting details from the official filings, and the Powerbeats Pro 2's accompanying documentation is no different.
What do we know about the Powerbeats Pro 2?According to the filing with the US FCC, the Powerbeats Pro 2 work with both iOS and Android, have Bluetooth Low Energy and do not have simultaneous transmission capability, which may mean you won't be able to connect to multiple devices at the same time.
We've previously gleaned a few other details too, thanks to those Apple teasers of the new buds back in late 2024. The design is similar to the current model but it's evolved, with more rounded edges and a more modern look.
The main section is significantly thinner and appears to be a little more angled. And thin is good, because it's likely to mean better comfort and less weight. Based on details found in the code for iOS, we're expecting black, beige, purple and orange color options.
Improved audio quality and battery life are expected, as are active noise cancelling and spatial audio. Multiple rumors have also suggested the addition of some health tracking features and possibly integration with Apple's Health app on iPhone.
You might also likeI’ve been using Apple Intelligence Notification summaries since September, and over five months later, I’m still yet to truly understand the benefit of Apple’s AI tool.
Apple Intelligence loves summaries in general, and most of the time, they're actually pretty good. Whether that’s summarizing emails or articles, Apple Intelligence has you sorted. It’s definitely not a necessity, nor are these summarizing tools worth upgrading to an iPhone 16 Pro for, but it’s a nice-to-have and I’ve grown to appreciate the options.
However, Apple has been in the news recently due to the notification summarization feature completely misinterpreting news from outlets like the BBC and The New York Times. From claiming Luigi Mangione, the man accused of killing the UnitedHealthcare CEO in New York, had killed himself to announcing Luke Littler had won the World Darts Championship final before the match had even begun, Notification summaries have been plagued with criticism.
There is so much criticism, in fact, that Apple has decided to halt Notification summaries for News and Entertainment apps altogether in the latest iOS 18.3 betas for the time being, as well as emphasize that all Apple Intelligence features, including this one, are still in beta.
AI requires trust and patience (Image credit: Apple)The AI era of software development is tricky for consumers like me to wrap their heads around; after all, we’re used to features launching when ready with incremental updates throughout the years rather than regular updates to fine-tune the tools already out in the wild.
In the case of Apple Intelligence and AI in general, it’s almost as if we, as consumers, need to come to terms with the fact that smarter software means more mistakes, and more mistakes means more consistent updates.
Apple has a track record of revealing software as part of hardware launches and releasing the features later. Think back to Deep Fusion, which was revealed as part of the iPhone 11’s major camera upgrades only to launch as part of iOS 13.2 months later. This time, however, it feels different; Apple wants users to know that Apple Intelligence and all it offers is still in beta, even if it’s available as part of a general software release. This almost protects the company from criticism, after all it’s hard to call a feature half-baked when it’s essentially still in development.
In the case of Notification summaries, we’ve got our first glimpse into how Apple will react to criticism of its new venture into generative AI, and the company’s response is somewhat reassuring. After an outpour of criticism towards the AI tool falsely summarizing notifications from news apps, Apple has chosen to switch the functionality off for the time being while it works on Apple Intelligence to ensure this accidental fake news doesn’t continue in the future.
This adjustment shows that AI in the iPhone will constantly evolve over time, depending on user feedback and technological evolutions.
iOS 18.3 is more important than we realizedOn paper, iOS 18.3 might not be the most glamorous Apple Intelligence update we’ve seen to date, but it could be the most eye-opening. After all, there was always going to be some backlash as Apple moved into an AI-fuelled world, and if, in order to get there, we, as consumers, need to go through some turbulence, then I think we’re just going to have to accept it.
In this new AI world, where every product, from robot vacuums to fridges, has the buzzword littered in marketing, consumers will have to accept that products and their software are likely to evolve, and that demands more trust in the companies we’re buying from.
I’m still bullish on Apple Intelligence and Apple creating smartphone AI tools that are more than just a gimmick, though. iOS 18.3 is the first sign that the company is willing to listen, and that fills me with hope for the future.
You might also likeOnline advertisements can be an annoying interruption to our normal browsing habits. However, they are often necessary because they serve as the primary funding source for the otherwise free websites we use daily. Ever wonder how those ads end up on your screen? Well, there’s a fascinating supply chain behind the ads, and it’s interesting to pick apart.
Typically, a website that serves ads does not hand-pick the specific advertisements displayed on its platform. Instead, it chooses ad categories to block, allocates ad space, and then displays whichever ads its advertising vendor provides. Advertisement vendors are responsible for sourcing advertisers and websites to display their advertisements. But what if those advertisers aren't legitimate? What if they're threat actors or scammers looking to lure potential victims with seemingly legitimate software or help fixing your computer? This malicious use of ads is referred to as malvertizing.
Malvertizing uses many of the same tactics as social engineering, relying heavily on persuasive language and attention-grabbing images to drive a sense of urgency or fear. This encourages victims to act quickly without inspecting the legitimacy of the website linked in the ad. Malvertizing attacks are becoming increasingly sophisticated, with cybercriminals leveraging trusted platforms like Facebook and other social media networks to distribute malicious content. By exploiting the trust and reach of these platforms, attackers can reach a wider audience and potentially compromise more victims. This also makes it more challenging for users to distinguish between legitimate and malicious ads.
Adding to the complexity, threat actors employ techniques to mask their identities and evade detection. This can include social engineering tactics such as phishing, token theft, or infostealers to gain access to legitimate ad accounts. By hijacking trusted accounts, attackers can bypass security measures designed to prevent malicious organizations from buying ad space.
Three common types of malvertizing attacks that users should be aware of are:Scam Malvertizing: Attackers will display ads with language similar to “Your computer is infected, call us immediately to remediate!”. Once a victim calls, the scammers will typically convince their victim to install software to initiate a remote control session of the victim’s computer. They’ll then overwhelm the victim with misinformation, hoping to confuse them into believing that the situation is too complex to understand, and then ask them to pay money to remediate the non-existent security concern.
Fake Installer Malvertizsing: A common technique that delivers malware directly to the victim, posing a more significant threat. Attackers disguise themselves as legitimate software vendors to deliver a modified version of the software that typically includes an infostealer or initial access mechanism. These attacks aim to catch the victim while they are in a hurry to install the software. Often, we see QuickBooks used as a lure, with attackers sponsoring malicious ads designed to be displayed next to legitimate QuickBooks links. The malicious ads then lead to a cloned QuickBooks website that serves users as a compromised installer. Similarly, fake browser extensions imitate legitimate ones, tricking users into installing them. Once installed, they can capture sensitive data, including browsing history, passwords, and credit card information, putting both individuals and businesses at significant risk.
Drive-by-download Malvertizing: These malicious ads require no engagement from the viewer; simply loading them in your browser is enough to install a new web extension or download malware. This tactic heavily relies on the victim not keeping their browser up to date and utilizes previously known and patched vulnerabilities. There is a reason your browser is constantly asking you to update it; these updates keep the browser secure against newly discovered weaknesses. Keep your browser updated, and don’t make attackers’ jobs easier.
Avoiding attacksTo avoid falling prey to malvertizing attacks such as scam malvertizing, it's essential to think critically before engaging with any suspicious ads. If you receive an ad claiming you are a victim and need to call for support, stop and ask if the claim even makes sense at face value. How would this vendor be aware you had a virus on your computer? Does Microsoft really have a division of staff proactively buying ad space to inform its customers there may be a virus on their computer? While answering these questions generally requires at least some level of technical acumen, there are other tale-tale signs that an ad may be a scam. Many of these scams claim to be Microsoft technician support or their security team. Check to see where the ad is going to take you. If the domain is not www.microsoft.com, then you can almost guarantee it is going to be a scam, especially when coupled with a message claiming it is time-sensitive or extremely critical.
Preventing yourself from falling victim to malvertizing requires a careful eye, taking a moment to stop and think about the claims of an ad, ensuring you are being redirected to a legitimate site, and clicking that ‘update’ button every time it shows up in your browser. To defend against malvertizing, advertisers should implement more rigorous checks on the advertisers and their content to ensure legitimacy. Additionally, employees should be trained to identify suspicious emails, websites, and online ads, empowering them to avoid falling victim to these attacks. Threat actors are using more and more legitimate tools maliciously, advertisements included. A healthy dose of skepticism never hurt anyone, so the next time you see a suspicious ad, be cautious and ensure it’s legitimate before clicking on it.
We've featured the best business VPN.
This article was produced as part of TechRadarPro's Expert Insights channel where we feature the best and brightest minds in the technology industry today. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/news/submit-your-story-to-techradar-pro
A Korean website is reporting that Samsung and OpenAI are collaborating together on an AI TV. The website describes it as an “open partnership” between the two companies. There's no mention of new hardware, but a software integration with ChatGPT has precedent since ChatGPT has already been integrated into Apple's operating systems as part of Apple Intelligence.
Samsung TVs currently run on the Tizen OS, and the Korean company has already introduced several AI features to them like AI Upscaling and AI Sounds, not to mention its new Vision AI, which was introduced at CES 2025. Vision AI can do things like ‘see’ what dish is on screen and find you the recipes for cooking it, then link to the Samsung food app. It can also do live translation.
Samsung vs Google TVSamsung integrating ChatGPT into its TV range might sound as if it comes out of the blue, but it makes strategic sense. The move comes as Google is about to add Gemini AI to its Google TV operating system, so that you can talk to your TV without a remote.
Announced at CES 2025, Google TV is a successor to Android TV, but has as cleaner interface, better recommendations for TV programs and also Gemini baked in, so you can activate it with the “Hey Google” voice control, and simply speak your requests, instead of having to use a TV remote.
Next generation Google TV devices aren’t expected to enter the market until towards the end of 2025, so we’d imagine a similar time frame for any OpenAI and Samsung collaboration.
Google TV points the way to the future of entertainment. (Image credit: Future) NPersonally I’d love the ability to talk to my TV, especially if it has something like ChatGPT or Gemini inside. I’d like to be able to ask it questions beyond the usual functional TV operation like asking it to record a program or find something on a streaming service. Recently it was revealed that Gemini could be available as you watch YouTube videos, so you can ask it questions about what you’re watching. Just imagine the ability to be able to ask your TV, “Who is this actor, and what else have I seen him in?” It could settle so many of the debates we have in our household about where we’ve seen so and so before. Not to mention eliminating the time it takes to currently pause the TV program, find our phones, and then look them up. Yes, software like Prime Video's X-ray exists, but it's not nearly as cool.
And that’s not even counting my biggest bug bear with my current AI-less TV experience – losing the remote. Every TV remote seems to be designed to be lost - they’re usually black, for a start, so impossibly hard to locate when the lights are low and you’re watching TV in the evening. Yes, I know there are tracking devices you can stick to your remote to help you locate them with your phone, but then you have to find your phone first!
While having ChatGPT or Gemini in your TV might sound a bit excessive to some people, I can genuinely say that I’d find it useful, and I’m looking forward to finally being able to lose my TV remote control for good.
You might also likeThe digital age has changed how financial services operate, pushing the industry to stay tech-savvy just to keep up. Yet, this tech-driven shift isn’t without its issues. Old legacy systems, tight regulations, and the demand for real-time data handling have put pressure on conventional solutions, making them feel outdated. But all-photonic networks, which connect endpoints directly with optical paths, could be the answer, helping the financial world stay fast, flexible, and sustainable.
The challenges financial services face todayTechnology is woven deeply into financial services, but that also adds complexity. One major obstacle is performance and latency issues. High-frequency trading, cross-border payments, and fraud detection all require real-time data processing, yet existing electronic networks, built on copper wires and fiber optics, struggle with delays, making it challenging to meet the accuracy needed for time-sensitive transactions. Another challenge is meeting regulatory demands. Compliance with regulations like Europe’s Digital Operational Resilience Act (DORA) is both tricky and costly. The laws in financial services demand strong data protection and operational stability, but current networks can sometimes fall short. Finally, sustainability pressures are becoming increasingly prominent. As sustainability becomes a core business goal, energy consumption from data centers and network infrastructures has emerged as a major concern, often clashing with firms’ eco-friendly ambitions.
So, what are photonic networks?Simply put, photonics is about using light - specifically photons - to transmit data. Unlike electrical signals in copper cables or even regular fiber optics, photonic networks use light to send data directly, skipping the usual electronic conversions. The result? Faster speeds, more data capacity, and far less energy consumption.
All-photonic networks send data as light without converting it back and forth between electrical signals. This setup reduces delays and improves energy efficiency, making photonics perfect for industries where fast, reliable data transfer is critical - like financial services.
How photonic networks could transform financePhotonic networks enable more predictable network pathways, ensuring consistently low latency. That’s a huge plus for financial firms that need every edge to stay competitive in their markets.
Staying compliant with rules like DORA isn’t easy; it requires institutions to be highly resilient and flexible. Photonic networks can help meet these demands by enabling real-time data oversight and faster data replication. This means better disaster recovery capabilities and more robust backup strategies.
These networks also support interconnected data centers with low-latency failover options, ensuring that operations can shift seamlessly during maintenance or outages. This flexibility makes it easier for financial institutions to meet recovery time objectives (RTO) and recovery point objectives (RPO) set by regulators.
Photonics and the path to sustainabilityData centers and networks consume vast amounts of power, which is a roadblock for companies aiming to reduce their environmental impact. Photonic networks offer a solution, using light for data transmission and avoiding the energy-hungry electronic conversion steps.
Adopting photonic systems helps firms cut down on energy costs by requiring less power for data transfer, ultimately lowering operational expenses. Additionally, by enabling more reliable data transfer, photonic networks would allow financial service institutions (FSIs) to relocate their data centers to rural areas, where sources of renewable energy are more accessible. This would help these organizations to align more closely with their ESG goals without having any negative impact on the speed of operations.
In an industry where meeting sustainability targets is linked to investor trust and public approval, this is no small thing.
Looking aheadWhile photonic technology is still finding its footing, its potential to reshape finance is clear. Embracing photonic networks can help financial firms address today’s issues while unlocking opportunities for innovation down the road. With better support for distributed computing, real-time analytics, and stronger data protection, FSIs can become more resilient, meet tough compliance standards, and hit sustainability goals - all while keeping costs under control.
The financial firms that choose to invest in photonic networks now will likely lead the pack in a rapidly changing market. With unmatched speed, reliability, and energy efficiency, photonics isn’t just a solution to today’s problems; it’s a way to future-proof operations for whatever comes next.
We've featured the best productivity tool.
This article was produced as part of TechRadarPro's Expert Insights channel where we feature the best and brightest minds in the technology industry today. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/news/submit-your-story-to-techradar-pro
In one of his last acts as President of the United States, Joe Biden has signed an executive order aimed at strengthening US national cybersecurity.
The order lays out a series of checks and reviews on third-party software providers for both government systems and critical infrastructure in order to ensure they are adhering to established cybersecurity standards and making active efforts to eradicate existing vulnerabilities.
The executive order posits the People’s Republic of China is the main threat to vulnerable networks, likely referencing numerous attacks against US critical infrastructure in early 2024 by the Chinese state-sponsored Volt Typhoon group, and subsequent attacks against US telecommunications networks by the group.
New security standards“I am ordering additional actions to improve our Nation’s cybersecurity, focusing on defending our digital infrastructure, securing the services and capabilities most vital to the digital domain, and building our capability to address key threats,” President Biden's order said.
It also builds upon previous requirements laid out in the Executive Order on Improving the Nation’s Cybersecurity from 2021, and implements greater security checks on third-party providers to ensure “software providers that support critical Government services are following the practices to which they attest.”
Third-party providers will therefore have to provide frequent demonstrations that their software and supply chains are secure, with the contracting agency being notified of those failing to meet security requirements.
The federal government is also mandated to adopt identity management software, phishing-resistant authentication, and end-to-end encrypted communications by default across DNS protocols, email, voice and video conferencing, and instant messaging.
Biden also looks to address the future threat of cryptanalytically relevant quantum computers (CRQC) which, when viable, will be able to break many of the encryption algorithms in use today. US agencies will be required to adopt quantum-safe encryption methods authorised by the National Institute of Standards and Technology (NIST).
You might also likeLeaseweb has announced the launch of a new virtual private server (VPS) hosting service aimed at improving flexibility and scalability for customers.
The infrastructure as a service (IaaS) specialist said the new VPS solution is specifically designed for businesses that require a “combination of exceptional price-performance, fast local storage, and easy deployment”.
The service will be delivered via a self-service portal, making it a click and go solution requiring “limited technical expertise” for setup and management, which the company says makes the solution ideal for firms seeking an entry-level service to the firm’s public cloud offerings.
What to expect from Leaseweb’s new VPS service“Our new VPS solution has been designed from the ground up to offer the ideal balance of performance, usability and cost,” said Mathijs Heikamp, Director Product Management at Leaseweb Global.
“By combining the latest hardware, advanced automation and an intuitive self-service portal, we're delivering a cloud infrastructure solution that can effortlessly adapt to customer requirements.”
The VPS service also provides users with built-in security and reliability features, according to Leaseweb. This includes firewalls, DDoS protection, and hosting via ISO-certified data centers.
A backup solution is also available, but as an add-on service.
The new Leaseweb VPS service includes six distinct packages for customers ranging in size and technical expertise.
The entry-level package, dubbed VPS 1, starts at $3.74 (£3.06) per month. This provides users with 4 vCPUs, 6GB of vRAM, and 100Gb of NVMe SSD storage, complete with 30TB of bandwidth and 10Gbps uplink.
Meanwhile, VPS 3 gives users double the vCPU capacity alongside 24GB of vRAM and 300GB of NVMe storage.
At the higher end of the spectrum, the VPS 6 package certainly kicks things up a notch, offering users 24 vCPUs, 120GB of vRAM, and 600GB of NVMe SSD storage capacity.
There’s quite a price jump between the mid-range and upper-tier packages, with VPS 6 setting users back $55.34 (£45.24).
All packages across the range guarantee 30TB of bandwidth and 10Gbps uplink, according to Leaseweb.
You might also likeWe were spoiled when it came to horror last year, and I'm hoping 2025 gets off to a strong start now we've got trailers for two exciting new movies. Whenever I reflect on TechRadar contributor Gem Seddon's best horror movies of 2024, I wonder how we're going to top that. Considering we had huge hits like The Substance and, my personal favorite, I Saw the TV Glow, I feel like it's going to take a lot to top that this year. I have already put together my most anticipated horror movies of 2025, and it looks like I'll be adding The Monkey and Until Dawn to the list.
Oz Perkins freaked everyone out with his horror-crime hit Longlegs last year, and hopefully, The Monkey will do just as well for him. Meanwhile, the PlayStation horror game sensation Until Dawn is getting the big screen treatment with a very important twist.
Here's what you need to know.
The MonkeyLonglegs was everywhere last year, and even if you weren't brave enough to watch Nicolas Cage as the titular serial killer, you've no doubt heard plenty about it. Choosing not to rest on his laurels, director Oz Perkins is back with another offering in the form of The Monkey. It's got my attention already since Saw and The Conjuring director James Wan is also involved as a producer.
The Monkey has a brilliant cast including Elijah Wood and Tatiana Maslany, with Theo James in a dual role as twin brothers who find their father's vintage toy monkey in the attic which, unfortunately for them, is cursed. We've had loads of creepy dolls like Chucky, Annabelle, and M3GAN on the big screen so I'm keen to see if this scary-looking monkey can reach similar heights. There's not long to wait either as the movie arrives on February 21.
Until DawnThis one is definitely going to divide people. Until Dawn is one of the best horror games out there, so it's natural people are going to feel apprehensive about the movie adaptation. Recently, it was confirmed that Until Dawn would follow a different story to the game and I personally think that's a smart decision. Setting the movie in the universe but surprising us with a narrative that differs from the game means it's new and exciting, although others aren't convinced!
In what is shaping up to be the most talked about horror adaptation right now, this one is heading to cinemas on April 25, so there's a little wait. But if you want some scares this spring, it might be worth giving Until Dawn a chance.
You might also likeMillions of VPN servers, home routers, and other internet hosts could be carrying multiple vulnerabilities which could allow threat actors to perform anonymous attacks and could grant them access to private networks, experts have warned.
New research from Mathy Vanhoef, a professor at the KU Leuven university in Belgium, PhD student Angelos Beitis, and Top10VPN discovered the vulnerabilities in multiple tunneling protocols: IPIP/IP6IP6, GRE/GRE6, 4in6 and 6in4, and were given these identifiers: CVE-2024-7595, CVE-2025-23018, CVE-2025-23019 and CVE-2024-7596.
VPN tunneling protocols are methods used to securely transmit data between a user's device and a VPN server by encapsulating it within an encrypted tunnel. Common protocols include PPTP, L2TP/IPsec, OpenVPN, and WireGuard, each offering varying levels of speed, security, and compatibility.
Millions of potential victimsThe vulnerable ones primarily function to encapsulate one type of IP packet (IPv4 or IPv6) within another for network routing purposes. Unlike VPN-specific protocols, these are generally used for network transport rather than encryption or secure communication.
The research argues the misconfigured systems accept tunneling packets without confirming the identity of the sender, making it, "trivial to inject traffic into the vulnerable protocols’ tunnels."
A malicious actor could send a packet encapsulated using one of the affected protocols with two IP headers, in which the outer header contains the attackers’ source IP with the vulnerable host’s IP as the destination. The inner header’s source IP is that of the vulnerable host IP, while the destination IP is of the target.
So, when the vulnerable host receives the packet, it strips the outer IP header and forwards the inner packet to its destination, paving the way for the creation of a one-way proxy, and abusing the bug to run DoS attacks, DNS spoofing, and more.
The researcher said they scanned the internet for vulnerable hosts and found 4.26 million, including various VPN servers, ISP-provided home routers, core internet routers, mobile network gateways and nodes, and CDN nodes, most of which were located in China.
“All vulnerable hosts can be hijacked to perform anonymous attacks, as the outer packet headers containing an attacker’s real IP address are stripped. These attacks are easily traceable to the compromised host, however, which can then be secured,” the researchers explained.
“Spoofing-capable hosts can have ANY IP address as the source address in the inner packet, so not only does an attacker remain anonymous, but the compromised host also becomes much harder to discover and secure,” they added.
You might also likeIn its effort to become the go-to “AI-first work platform for human connection” – a term coined by the company in its Zoom 2.0 rebranding in November 2024 – Zoom has introduced a series of new AI tools to its Team Chats.
The redesigned Team Chat sidebar includes new organization functions like drag-and-drop tab arrangement, advanced sorting and filtering.
Key to the updated Team Chat sidebar are the new AI Companion enhancements, which include conversation summarization in select chats and channels, action item identification and information retrieval through an improve search feature.
Zoom overhauls its Team Chat sidebar with AI“With Zoom Team Chat, you can do cross-product work and be more productive with Zoom Workplace’s AI-first products like Zoom Docs, Zoom Meetings, and Zoom Whiteboard," Zoom CPO Smita Hashim commented.
In a bid to cater to its developer users, Zoom has also added code block and in-line code support to help users format and share code from within the application.
“Our new Team Chat sidebar design takes this to the next level by empowering users to collaborate smarter and customize their workspace to fit their preferred workflow," added Hashim.
"With AI Companion… users can triage and track their messages more easily, saving time and allowing them to focus on what matters most.”
The redesigned sidebar and AI Companion are available to paying Zoom Workplace subscribers for no additional charge.
The new changes are part of CEO Eric Yuan’s plan to make Zoom 2.0 a “fully customizable digital twin” that can save employees an entire working day each week in unproductive time.
You might also likeSony has canceled two unannounced live service games.
According to Bloomberg, a Sony spokesperson confirmed that they were canceled "following a recent review”. They were in development at two PlayStation studios, Bend Studio and Bluepoint Games.
Bend Studio is known for developing PlayStation exclusives, most recently Days Gone. Bluepoint Games usually specializes in comprehensive remasters or remakes, such as the PlayStation 5 release of Demon’s Souls as well as the PlayStation 4 version of Shadow of the Colossus.
Although the games have been canceled, neither studio will be shut down. “Bend and Bluepoint are highly accomplished teams who are valued members of the PlayStation Studios family,” the spokesperson continued. “We are working closely with each studio to determine what are the next projects.”
Sony also specified that it intends to “do everything we can to ensure there is minimal business impact,” though it’s not clear whether this will involve some job cuts. Bluepoint Games was reportedly working on a live service God of War title, likely similar in scope to the The Last of Us Online game developer Naughty Dog that was cancelled in December 2023.
These two unannounced games were part of a wider push by Sony to invest in live-service tiles, which can be very successful. The likes of Fortnite or Destiny 2 provide a constant revenue stream and can keep players engaged for years via frequent content updates. That said, an extremely crowded market makes putting out a new live service a very risky endeavor.
Last year Sony launched Helldivers 2, which sold well and is the perfect example of a live-service hit. On the opposite end of the spectrum we also saw the high-budget Concord struggle to make much of an impact, with disastrous sales that led to its shutdown just two weeks after it launched. It seems safe to assume that these cancellations are measures to try and avoid a similar disaster.
You might also like...Microsoft has released a patch for a critical vulnerability that allowed threat actors to distribute malware through its Outlook email client - and given the severity of the flaw, users are advised to install the patch immediately.
In a security advisory, Microsoft detailed CVE-2025-21298, a use-after-free vulnerability with a severity score of 9.8/10 (critical). Use after free is a vulnerability in which threat actors are able to use previously freed memory, which allows them to corrupt valid data, or in this scenario - distributing malware remotely.
Located in the Windows Object Linking and Embedding (OLE) function, the bug means simply viewing a malicious email in the preview pane is enough to have the endpoint infected with malware. Windows OLE is a technology that allows embedding and linking to documents and other objects. For example, users could embed an Excel chart into a Word document, and updates in the Excel file will reflect in the Word document, if linked.
Specially crafted emails“In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted email to the victim,” Microsoft explained in the advisory.
“Exploitation of the vulnerability might involve either a victim opening a specially crafted email with an affected version of Microsoft Outlook software, or a victim's Outlook application displaying a preview of a specially crafted email . This could result in the attacker executing remote code on the victim's machine.”
For those that cannot apply the patch immediately, Microsoft suggests a number of mitigations, including viewing emails as plain text and, in large LAN networks, restricting NTLM traffic, or disabling it altogether. Viewing emails as plain text means other multimedia, such as images, animations, or different fonts, will not be displayed.
It’s worth the trouble, though, since the malware sent this way can cause severe business disruptions, loss of customers, and possibly even regulatory fines.
Via NotebookCheck
You might also likeThe Samsung Galaxy S25 series is almost here, but reports suggest their batteries won’t be any bigger than last year’s phones. So, if you’re hoping for improved battery life, you might want to wait for the Samsung Galaxy S26 series, which could have much bigger batteries.
According to @Jukanlosreve – citing leaker @UniverseIce – the Samsung Galaxy S26 series will use silicon-carbon batteries. This kind of battery has only recently started making its way into phones, with the likes of the OnePlus 13, Honor Magic 7 Pro, and Xiaomi 15 Pro already having silicon-carbon batteries.
Those three phones have much larger batteries than most handsets, at 6,000mAh, 5,850mAh, and 6,100mAh respectively, and that’s no coincidence, as this kind of battery allows for around 10-15% higher energy density, so a higher capacity battery can take up the same amount of space.
Update: The S26 will use a silicon-carbon battery.Source: Ice Universe, Undead Weibo. https://t.co/6KBDQlNvFWJanuary 16, 2025
Up to around 5,750mAhThe source doesn’t say what capacities we can expect from the batteries in the Samsung Galaxy S26 series, but for reference, the Samsung Galaxy S24 has a 4,000mAh battery, the Samsung Galaxy S24 Plus has a 4,900mAh one, and the Samsung Galaxy S24 Ultra has a 5,000mAh battery. We’re expecting the same from the Samsung Galaxy S25 series.
So, assuming an increase of 10-15%, we might be looking at somewhere between 4,400mAh and 4,600mAh for the Samsung Galaxy S26, between 5,390mAh and 5,635mAh for the Galaxy S26 Plus, and between 5,500mAh and 5,750mAh for the Samsung Galaxy S26 Ultra.
Those are big enough increases that these phones could last substantially longer between charges than current Galaxy S models, so if battery life is a priority for you, they might be worth waiting for.
Of course, this is just a rumor for now, and a very early one at that, so even though the source is reputable we wouldn’t count on it happening.
Plus, while rumors suggest the battery capacities in the Samsung Galaxy S25 line won’t be higher than in the S24 series, we won’t be certain of that until these phones launch on January 22. And even if there’s no change in capacity, they might still offer improved life through software optimizations.
So, you might not actually have to wait until 2026 for a longer-lasting Samsung smartphone, but in any case, we’ll have a clearer idea soon.
You might also likeMotorola has released the newly refreshed Moto G and Moto G Power budget smartphones, bringing flagship-level features to highly affordable handsets.
Both phones are refreshes of existing models, but in both cases they bring a number of high-quality features at very low price points – in fact, the new Moto G costs just a few cents more than a quarter of the price of a new iPhone 16.
The new Moto G features a 6.7-inch display with a 120Hz refresh rate and 1000 nits of maximum brightness, protected by Corning Gorilla Glass 3. The phone sports a water-resistant design (no IP rating given yet) that resembles the previous generation Moto G.
As for internals, the phone comes with a MediaTek Dimensity 6300 chipset, a midrange platform that can also be found powering budget phones from Oppo and TCL. The Moto G comes equipped with a 50MP main camera and a 2MP macro camera, too.
The new Moto G (pictured) features a 5000mAh battery (Image credit: Motorola )The Moto G Power is a slightly upgraded version of the Moto G, with a few choice improvements. The display is bumped up from 6.7 inches to a 6.8-inch panel, and the phone has received dual IP68 and IP69 ratings, offering complete dust and water protection. It packs the same MediaTek Dimensity 6300 processor as its smaller sibling.
Furthermore, the Moto G Power is rated at the MIL-STD-810H certification for durability, offering extended protection against extreme temperatures and drops of more than three feet.
Additionally, the Moto G Power gets an 8MP ultra-wide camera alongside the 50MP main and 2MP macro cameras found on the standard Moto G.
Both phones have the same 5000mAh battery capacity, with support for 30W wired charging (the Moto G Power gets 15W wireless charging, too). Additionally, both phones have had their speaker systems retooled, with support for Dolby Atmos and hi-res audio, as well as a proprietary bass boost technology, and both offer support for 5G connectivity.
The Moto G will launch on January 30 at a retail price of $199. The Moto G Power will launch on February 6 for $299. We've reached out to Motorola to check on UK and Australia pricing and availability and will update this article in due course.
If you can’t wait until the new Moto G phones release, be sure to check out our lists of the best Motorola phones and the best cheap phones.
You might also likeYour Philips Hue lights could soon get a lot smarter thanks to a free firmware update that would let them do double-duty as occupancy sensors. It involves an update to the Zigbee wireless protocol, and could allow your bulbs and lamps to detect your presence without the need for any extra hardware.
When you connect your smart lights, switches and other devices to a Philips Hue Bridge, it creates a mesh network using the Zigbee protocol. This allows all the devices to communicate with the Bridge and one another, and receive over-the-air (OTA) firmware updates to fix bugs and add new features.
This week, the Connectivity Standards Alliance (CSA), the organization behind Zigbee, announced a new feature called Ambient Sensing that will let Zigbee devices like Hue lights sense whether you're home without any extra hardware. It will be available for both new and legacy devices, and will be rolled out via an OTA update.
In a short video, the CSA explained that Ambient Sensing will "unlock new user experiences such as autonomous lighting control and home security, all while enjoying the privacy of running 100% locally without adding occupancy sensors in every room."
When is it coming?As Mike Robinson of TechCrawlr explains, it's still early days for Ambient Sensing. The CSA hasn't offered a timeline for when it will roll out, and Signify (the company behind Philips Hue) hasn't given any indication of whether it'll be available for Hue bulbs and lamps. Nevertheless, it seems like a natural addition to the Hue system, and could even replace the Philips Hue Intelligent Indoor Motion Sensor.
Fabian of Hueblog.com (a reliable source of early information on Philips Hue) claims to have insider information on the subject, including some details of requirements for Ambient Sensing.
"According to the information available to me, the Philips Hue function requires at least three light sources in a room, which must be placed at a certain distance and in a suitable shape," Fabian says. "A permanent power supply to the light sources is of course essential. It should also be possible to set the intensity of the motion detection."
Signify already has some interesting plans for the coming year, including an AI assistant that will create custom lighting scenes for you using voice commands, but this sounds like a more practical, and potentially more useful feature. I'll keep my ear to the ground for more news and keep you updated as soon as I know more.
You might also likeThe free upgrade to Windows 11 won’t be canned when Windows 10 runs out of support, as a recent hint dropped by Microsoft seemed to indicate might be a possibility.
This stemmed from a blog post written about the free upgrade to Windows 11, where in the headline, the author had noted that this offer would run “for a limited time only.”
If you recall, I discussed this at length earlier this week, concluding that it seemed unlikely Microsoft would close the door on those who want to move from Windows 10 to Windows 11. But that at the same time, it certainly represented a hint that this could happen, backed up by the fact Microsoft has always had a caveat in place with the freebie upgrade, that it “reserves the right to eventually end support for the free offer.”
Well, it seems that any worries about this were misplaced, as Microsoft has removed the blog post in question.
Windows Latest picked up the ditching of the article, and also heard directly from Microsoft that it was taken down because it contained incorrect information. Indeed, Microsoft clarified that the free upgrade to Windows 11 is “not a limited-time deal” putting any doubt out of the minds of Windows 10 users who aren’t yet ready to make the leap (but are planning to eventually).
Furthermore, this blog post also told us that Microsoft 365 apps would stop working on Windows 10 when its support expired in October 2025, which isn’t true, the software giant separately confirmed.
(Image credit: Shutterstock - Wachiwit) Analysis: A throwaway line in a now-thrown-away postIt seems we can all rest easy about any vague possibility of Microsoft canning the free upgrade, then. Although never say never, I guess, particularly as there is that caveat mentioned above, but if the offer is ever taken off the table, it probably won’t be for a long time yet.
Naturally, Microsoft still wants to push Windows 11 adoption, as the numbers of Windows 10 users migrating across to the newer operating system have been well below what the software giant doubtless expected.
Compared to the pace of Windows 7 and 8 users transferring over to Windows 10, the move from that OS to Windows 11 has been woefully sluggish. (Although gamers have embraced Windows 11 with more enthusiasm, to be fair, and it is actually more popular than Windows 10 now, at least on Steam).
So, what happened with the now-deleted blog post? It seems like a simple mistake, and a possible theory is that it was a throwaway line added at the last minute (maybe by an editor). I say that because there was no mention of any time limit for the Windows 11 free upgrade anywhere in the body text of the article – it was only referred to in the headline, and that always seemed odd.
If you’re running Windows 10, and have been putting off upgrading – as opposed to being ruled out of Windows 11 by the steeper hardware requirements – I’d suggest you start getting your house in order regarding the move now. Before you know it, January will be over, and then February, and then… let’s put it this way, you’ll be facing down October 2025 (when Windows 10 support ends) before you know it.
Start the planning now, in terms of finding out what you might have to do (such as enabling TPM 2.0 in the BIOS of your motherboard, which is one of the common hurdles preventing upgrades – but it’s easily overcome with the flick of a switch in the firmware).
You may also like...Garmin has just rolled out its Q1 public software beta for the best Garmin watches on the market, bringing enrolled users a slew of new software upgrades to start the year.
Garmin's public beta program gives enrolled users automatic software updates containing features not yet available to the public, for the purposes of testing and feedback.
The Q1 release is no different, and is an exciting look at the free software upgrades other Garmin users can expect later this year. While not every upgrade is available for every model, there's at least one upgrade for every major device, including the premium Fenix and Epix models, the Forerunner range, and everyday models like the Garmin Venu 3 and Garmin Lily 2.
The Q1 headline is an upgrade to strength workouts, which are now included in existing running and cycling programs, rather than just as standalone plans. It means runners and cyclists training for a specific goal can incorporate strength and conditioning into their workout, with options for full gym access or bodyweight-only workouts. Here's the full breakdown.
Garmin's Q1 beta upgrade (Image credit: Garmin)There are five main upgrades in the Q1 Garmin beta cycle. As mentioned, the strength workouts incorporated into Garmin Coach running and cycling plans is the main upgrade for Coach. These will be available on the Garmin Fenix 8, Garmin Enduro 3, Forerunners 255/265/955/965, and the Edge 540/840/1040/1050/Explore 2 ranges of cycling computers.
The Q1 beta also adds workout execution score improvements to the Garmin Fenix 8, Enduro 3, Fenix 7, Pro, Epix, Enduro 3, Tactix 7, and Quatix 7.
Fenix 8 and Enduro 3 users also benefit from a new update keyboard that promises simpler and more efficient typing, including QWERTY alphabet and symbols layout, autocorrect, predictive takes, and switching between different keyboard layouts.
Finally, Garmin's Body Battery now supports TrueUp, which means your Garmin Body Battery score will draw on data gathered from multiple activity trackers. Metrics taken into account now include Calories, Floors, Intensity Minutes, Steps, and Step distance traveled.
This is great news for dedicated Garmin owners with more than one watch, perhaps a dedicated running watch as well as an all-rounder. This feature is available on every Garmin smartwatch available to enrol in the beta: all of the aforementioned models, plus the Venu 3, Garmin Vivoactive 5, and the Garmin Forerunner 165. You can see the breakdown below.
(Image credit: Garmin)You can sign up for the Garmin public beta on the company's website, enrolled devices should get the Q1 public beta automatically as a software update.
You might also like...